007 First Light Ending Potentially Leaked After IGRS Security Failure

With less than six weeks until launch, 007 First Light has run into the kind of trouble no developer wants. A security flaw in Indonesia's game rating system has resulted in over an hour of footage circulating online, and yes, that footage is believed to include the game's ending.

Not a datamine. Not a rogue insider. A ratings board. Of all the ways to have your story spoiled before release.

What Actually Happened

According to VGC, the Indonesian Game Rating System (IGRS) had a significant security flaw in its backend. Someone discovered it while building an alternative frontend for the IGRS website and, in doing so, stumbled across a database of private developer submissions that was far more accessible than it ever should have been.The breach exposed information on more than 1,000 games, many unreleased, including gameplay footage submitted purely for classification purposes.

That footage was never meant to see daylight. And yet here we are.

VGC confirmed the 007 First Light clips are genuine and actively circulating. The leaked material spans what appears to be a substantial portion of the game's story, with the ending seemingly among it. IO Interactive has not confirmed or denied whether that specific footage actually represents how the game wraps up.

Why Rating Submissions Are So Vulnerable

This is worth understanding, because it keeps happening across different boards in different regions.

When a studio submits a game for age classification, they're required to provide detailed in-game material, footage of violent scenes, language, sexual content, gambling mechanics, and so on. Basically, all the stuff a ratings body needs to see. That means the submission package often ends up being a fairly complete picture of the game, story moments included.

Riot Games' age ratings manager, Nic McConnell, addressed the situation publicly after the leak surfaced. He explained how the IGRS process works: developers fill out a survey and submit footage links, often via Google Drive. He wrote that it "wouldn't blow my mind if some links got opened more broadly somehow" given how manual the review process is, and described the system as "very much a work in progress." He added that the IGRS team appears small and under-resourced, saying "my sense is it's a small group of good folks doing their best." His practical advice to developers: "only share the most relevant submission materials."

That's useful guidance. Though it doesn't exactly solve the underlying problem.

Other Games Caught in the Same Breach

007 First Light wasn't the only casualty here. Bandai Namco's Echoes of Aincrad, Ubisoft's Assassin's Creed: Black Flag Resynced, and Konami's Castlevania: Belmont's Curse were all part of the same exposure. Footage from Echoes of Aincrad has also made the rounds, including cutscenes with what look like significant story beats. For the Assassin's Creed and Castlevania titles, no footage had publicly circulated at the time of writing, but the submission data was still exposed.

The Bond Game Context

This is IO Interactive's first James Bond project and arguably one of the most anticipated gaming revivals in years. The franchise has been dormant in games for well over a decade, and First Light is framed as a full origin story, presenting a younger, less polished, more reckless Bond before he became the agent fans know. Actor Patrick Gibson leads the role.

The game launches 27th May on PS5, Xbox Series X/S, and PC. The Switch 2 version was recently delayed, now expected sometime in summer.

A story-driven origin like this lives or dies by its narrative payoff. Having the ending out in the wild a month before release is, to put it plainly, a rough situation.

What You Should Do

If you're planning to play this at launch and want to go in clean, the advice is straightforward. Set up social media filters for "007 First Light" and "First Light spoilers" for the next few weeks. Avoid gaming subreddits, YouTube recommendations, and any posts flagged as leaks. The footage is out there and it will spread further before IO Interactive (or anyone else) addresses it properly.

IO Interactive has stayed quiet so far. No statement, no confirmation, no denial. Whether they respond or simply ride it out until launch remains to be seen, though given the spoiler severity, some kind of communication before 27th May would probably be appreciated by the fanbase.